[Petya V4sechkin]

Минидамп

Выложите DMP-файлы в архиве.

[r1k]

Прошу

[Petya V4sechkin]

r1k, во всех дампах процесс rundll32.exe (к сожалению, неизвестно, с какими параметрами он запущен).
Как дела с вирусами обстоят?

И содержимое стека:

Код:

STACK_TEXT:  
f2d082c4 80587c47 00000000 f2d082dc f2d08458 nt!ExpAllocateHandleTableEntry+0x13
f2d082e0 80587fa4 00000000 f2d08314 00000000 nt!ExCreateHandle+0x17
f2d0832c 80595946 00000000 885f09e8 00000000 nt!ObpCreateHandle+0x2f1
f2d0842c 8059bae7 885f09e8 f2d08458 00000000 nt!ObInsertObject+0x31a
f2d08590 8059b30e f2d085fc 001f03ff 00000000 nt!PspCreateThread+0x628
f2d085c4 f5e2db07 f2d085fc 001f03ff 00000000 nt!PsCreateSystemThread+0x31
f2d085f4 f5e21985 891845d0 89174c68 f5e21928 rdpdr!TSAddWorkItemToQueue+0xc2
f2d08610 f5e2341a 8865c8e0 88619490 00000000 rdpdr!VirtualChannel::SubmitClose+0x43
f2d08628 f5e234a5 00000000 88619490 f5e2359a rdpdr!DrSession::DeleteChannel+0x56
f2d08634 f5e2359a e15a1c40 f5e237fb e15a1c40 rdpdr!DrSession::ChannelIoFailed+0x11
f2d0863c f5e237fb e15a1c40 8865c8f8 8865c953 rdpdr!DrSession::SendCompletion+0x40
f2d08650 804f01d4 00000000 8865c8e0 e15a1c40 rdpdr!DrSession::SendCompletionRoutine+0x1b
f2d08680 f62d2b57 8865c950 8865c8e0 88c637f8 nt!IopfCompleteRequest+0xa0
f2d086cc f62d47ae 887ee168 8865c8e0 8865c950 termdd!IcaWriteChannel+0xf5
f2d086dc f62d4c0c 8865c8e0 8865c950 00000000 termdd!IcaWrite+0x3a
f2d086f0 804f04f3 89071c30 8865c8e0 88c637d8 termdd!IcaDispatch+0xd0
f2d08700 f5e21531 00000000 e15a1c40 887a9c70 nt!IofCallDriver+0x3f
f2d08724 f5e2191b f5e237e0 e15a1c40 f2d08850 rdpdr!VirtualChannel::Io+0x7d
f2d08758 f5e219de f5e237e0 e15a1c40 f2d08850 rdpdr!VirtualChannel::SubmitIo+0xc1
f2d0877c f5e238aa f5e237e0 e15a1c40 f2d08850 rdpdr!VirtualChannel::Write+0x1c
f2d087a8 f5e238ec f2d08850 00000038 8861961c rdpdr!DrSession::PrivateSendToClient+0x7c
f2d087cc f5e22a42 f2d08850 00000038 8861961c rdpdr!DrSession::SendToClient+0x1c
f2d087f0 f5e25ac8 f2d08820 887a9c70 f2d08850 rdpdr!DrExchangeManager::StartExchange+0x30
f2d08824 f5e2632c 885f0d50 f2d08850 00000038 rdpdr!DrDevice::SendIoRequest+0xa8
f2d0888c f5e1e873 885f2ea0 885ecd08 885ecc88 rdpdr!DrDevice::Close+0xa8
f2d088a4 f5e3aab4 885ecc88 00000000 8918f770 rdpdr!DrCloseSrvOpen+0x23
f2d088c8 f5e3af61 885ecc88 e1dc19d0 886bcc4c rdpdr!RxCloseAssociatedSrvOpen+0x198
f2d0891c f5e28268 885ecc88 886bcbb8 885f41a8 rdpdr!RxCommonClose+0x22b
f2d089ac f5e324d8 f5e30088 886bcbb8 885f41a8 rdpdr!RxFsdCommonDispatch+0x320
f2d089cc f5e1e4f0 89073030 886bcbb8 886bcbb8 rdpdr!RxFsdDispatch+0xd2
f2d089f0 804f04f3 89073030 886bcbb8 f1e3e6ec rdpdr!DrPeekDispatch+0xf2
f2d08a00 f1e097dd 8909f550 f2d08a54 804f04f3 nt!IofCallDriver+0x3f
WARNING: Stack unwind information not available. Following frames may be wrong.
f2d08a0c 804f04f3 88805748 886bcbb8 886bcbc8 eamon+0x37dd

Драйвер eamon.sys относится к ESET.